From 104fa3ad55bbf1be312130b3bb18fc704583afc0 Mon Sep 17 00:00:00 2001 From: Seth Schoen Date: Thu, 11 Feb 2016 09:10:25 -0800 Subject: [PATCH 1/4] Separate error for -d with an IP address --- letsencrypt/le_util.py | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/letsencrypt/le_util.py b/letsencrypt/le_util.py index 527c9bdae..73d112eca 100644 --- a/letsencrypt/le_util.py +++ b/letsencrypt/le_util.py @@ -6,6 +6,7 @@ import logging import os import platform import re +import socket import stat import subprocess import sys @@ -317,6 +318,15 @@ def enforce_domain_sanity(domain): # Remove trailing dot domain = domain[:-1] if domain.endswith('.') else domain + # Explain separately that IP addresses aren't allowed (apart from not + # being FQDNs) because hope springs eternal on this point + try: + socket.inet_aton(domain) + raise errors.ConfigurationError("Requested name {0} is an IP address. The Let's Encrypt certificate authority will not issue certificates for a bare IP address.".format(domain)) + except socket.error: + # It wasn't an IP address, so that's good + pass + # FQDN checks from # http://www.mkyong.com/regular-expressions/domain-name-regular-expression-example/ # Characters used, domain parts < 63 chars, tld > 1 < 64 chars From beeb65d2f24f10a19a31b3bcf97322f7d11ce8bf Mon Sep 17 00:00:00 2001 From: Seth Schoen Date: Tue, 16 Feb 2016 12:24:29 -0800 Subject: [PATCH 2/4] Add test --- letsencrypt/tests/cli_test.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/letsencrypt/tests/cli_test.py b/letsencrypt/tests/cli_test.py index 8184a557e..77a4b5892 100644 --- a/letsencrypt/tests/cli_test.py +++ b/letsencrypt/tests/cli_test.py @@ -351,6 +351,11 @@ class CLITest(unittest.TestCase): # pylint: disable=too-many-public-methods self._call, ['-d', '*.wildcard.tld']) + # Bare IP address (this is actually a different error message now) + self.assertRaises(errors.ConfigurationError, + self._call, + ['-d', '204.11.231.35']) + def _get_argument_parser(self): plugins = disco.PluginsRegistry.find_all() return functools.partial(cli.prepare_and_parse_args, plugins) From 16761bc8367497d2a00221d5165de1f11dcaaea0 Mon Sep 17 00:00:00 2001 From: Seth Schoen Date: Tue, 16 Feb 2016 13:00:08 -0800 Subject: [PATCH 3/4] Fix lint line-too-long complaint --- letsencrypt/le_util.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/letsencrypt/le_util.py b/letsencrypt/le_util.py index 73d112eca..1178d1968 100644 --- a/letsencrypt/le_util.py +++ b/letsencrypt/le_util.py @@ -322,7 +322,10 @@ def enforce_domain_sanity(domain): # being FQDNs) because hope springs eternal on this point try: socket.inet_aton(domain) - raise errors.ConfigurationError("Requested name {0} is an IP address. The Let's Encrypt certificate authority will not issue certificates for a bare IP address.".format(domain)) + raise errors.ConfigurationError( + "Requested name {0} is an IP address. The Let's Encrypt " + "certificate authority will not issue certificates for a " + "bare IP address.".format(domain)) except socket.error: # It wasn't an IP address, so that's good pass From 31a27f675ae00a7762170bee1b8ad683a3a8e9ac Mon Sep 17 00:00:00 2001 From: Seth Schoen Date: Tue, 16 Feb 2016 14:41:02 -0800 Subject: [PATCH 4/4] Trivial change to re-run tests after spurious integration test failure --- letsencrypt/le_util.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/letsencrypt/le_util.py b/letsencrypt/le_util.py index 1178d1968..c8a9d24c2 100644 --- a/letsencrypt/le_util.py +++ b/letsencrypt/le_util.py @@ -319,7 +319,7 @@ def enforce_domain_sanity(domain): domain = domain[:-1] if domain.endswith('.') else domain # Explain separately that IP addresses aren't allowed (apart from not - # being FQDNs) because hope springs eternal on this point + # being FQDNs) because hope springs eternal concerning this point try: socket.inet_aton(domain) raise errors.ConfigurationError(